Motivation: avoid overload when we use `open nat`. Unfortunately, we currently do not allow users to mark inductive datatype declarations as protected.